With the rapid development of network technologies and the improvement of technologies, people's life enters a high-speed communication era. 2G, 3G and 4G networks are widely deployed, thus not only facilitating communications between people, but also improving data traffics borne by the 2G, 3G and 4G networks exponentially. A communication network enters an era of large-volume data network. A signaling monitoring system in the related signaling monitoring technology encounters the problems of a difficulty in access, a single-point device performance handling bottleneck, a difficulty in multi-point processing interface association analysis and the like for huge signaling traffics in the network.
FIG. 1 is a composition structure diagram of a signaling monitoring system of a Long Term Evolution (LTE) network. As shown in FIG. 1, an operator needs to monitor an S1-Mobility Management Entity (MME) interface of the LTE network. Since an S1-MME interface signaling is encrypted, it is impossible for the signaling monitoring system to decrypt the interface signaling if the signaling monitoring system only collects the S1-MME interface. In order to decrypt the S1-MME interface signaling, interfaces such as S10, S11 and S6a need to be further collected simultaneously. That is to say, multi-interface flow association analysis needs to be carried out to realize decryption of the S1-MME interface signaling of a user. The traffic of each interface of the LTE network is large, multiple interfaces need to be collected in a whole network, and the interfaces also need to be associated. Therefore, the signaling monitoring system cannot be applied, practically.
To solve the abovementioned problem, a technical solution as shown in FIG. 2 is provided. FIG. 2 is an architecture diagram of a single-point large-traffic interface access solution. The single-point large-traffic interface access solution substantially includes: performing single-point traffic access by using a data interface supporting a large traffic, and performing analysis by using a high-performance calculation device. For example, network traffic is accessed by using a single-point interface supporting 100G data, and calculation and analysis are performed. The advantage of the solution lies in that single-point large-traffic access can be achieved. However, the single-point large-traffic interface access solution has very high requirement on an interface exchange buffer mechanism, thus resulting in high cost and high investment of the interface module. In addition, only simple logic distribution, e.g., distribution based on an Internet Protocol (IP) or a port, can be performed on an interface, while distribution based on upper-layer protocol cannot be performed, thus resulting in that the distributed data is complicated and multi-analysis module concurrent processing cannot be effectively performed. Moreover, more importantly, a single-point bottleneck may be caused, and the performance cannot satisfy large-traffic code stream processing requirements. The evolution of the single-point large-traffic interface access solution is the adoption of multiple data analysis modules, but the same problem still exists.
Another technical solution is as shown in FIG. 3. FIG. 3 is an architecture diagram of a multi-point distributed access solution. According to the multi-point distributed access solution, access analysis is performed on different interface data independently by using multiple access modules; and network signalings are independently distributed to multiple subsequent analysis modules for processing, so as to realize certain signaling distribution and distributed processing. The advantages of the multi-point distributed access solution lie in that multi-point accesses can be adopted, and the requirements on a single access module is not high, thereby greatly reducing the cost. However, multi-point accesses in the multi-point distributed access solution are independent. The multiple points do not contact with each other, cannot share information, and cannot meet the requirement of association. The multi-point distributed access solution cannot support a scenario of whole-network multi-interface association analysis, such as a scenario of multi-interface association analysis in LTE.